Desktop image management for virtual desktops using a branch reflector

ABSTRACT

A desktop image management system is described that can efficiently distribute updates to virtual desktops running on host servers in a data center. The system is comprised of a central server and multiple agents, each agent installed on a virtual machine. When a VM receives an update from the central server, the files are stored in a single instance store on the host server. Corresponding stub files (empty of content) are created on the VM for each file in the single instance store. The stub files are marked to indicate that the stub file is mapped to the single instance store. When the guest operating system requests to read the stub file, the virtual disk layer of the host server detects that the requested block has been marked and fetches the content of the file from the single instance store.

TECHNICAL FIELD

The present disclosure generally relates to virtual desktop imagemanagement and more particularly relates to techniques for modifying orupdating software and other content on virtual machines that hostvirtual desktops.

BACKGROUND

Enterprise desktop management is one of the most challenging tasks forInformation Technology (IT) departments of large organizations today. Atypical IT department needs to manage, protect, and distribute softwareupdates and modifications, upgrade operating systems and applications,as well as be able to back up and restore the user's data and settingson demand. One issue for IT departments is the complexity of managing alarge number of different desktop instances that may exist on thecomputers of enterprise users. The sheer number of user computers tomanage; the proliferation of operating system (OS) images andapplications; and the complex set of operations, such as deployment,provisioning, patching, upgrading, installing and managing applications,compliance testing, troubleshooting and re-imaging; all make ITresponsibilities a very challenging task. To compound thesedifficulties, today's enterprises are often dispersed over multiplegeographic locations and the use of Local Area Networks (LANs) connectedover one or more Wide Area Networks (WANs) with variable bandwidths andlatencies is a serious barrier to providing efficient desktop managementwithout sacrificing end user experience.

Virtual Desktop Infrastructure (VDI) can provide some aid to ITdepartments by virtualizing the desktops of individual end users. In aconventional VDI environment, each user in an enterprise is provisioneda virtual desktop and is allowed to access their virtual desktop over aremote network connection, such as a WAN connection. The virtualdesktops are typically hosted on servers that reside in a data center ofthe enterprise (or a third party service provider), and each host servermay execute multiple virtual desktops. Users can utilize a client deviceto remotely log into their individual virtual desktop and all of theapplication execution takes place on the remote host server which islinked to the local client device over a network using a remote displayprotocol, such as remote desktop protocol (RDP), PC-over-IP protocol(PCoIP), virtual network computing (VNC) protocol, or the like. Usingthe remote desktop protocol, the user can interact with applications ofthe virtual desktop, which are running on the remote host server, withonly the display, keyboard, and mouse information communicated with thelocal client device. A common implementation of this approach is to hostmultiple desktop operating system instances on a server hardwareplatform running a hypervisor.

VDI provides a more centralized and efficient client environment that iseasier to manage by enterprise IT administrators, who are able torespond more quickly to the changing needs of the user and the business.However, many issues with desktop management still persist in the VDIenvironment. For example, the IT department often needs to distributeupdates or install new software to all desktops in the enterprise aspart of an upgrade or migration process. It is usually desirable toperform such distribution of updates while the users are using theirdesktops so as not to disrupt normal business operations. If such adistribution were to be performed in a conventional VDI model, all ofsuch updates would need to be distributed and installed on each andevery virtual desktop. However, because each server in a data centertypically hosts many different virtual desktops that share the physicalresources of the server, such distributions/installations are likely tooverwhelm a server's physical resources and degrade the overall userexperience. A more efficient approach is desirable for distributingupdates within a VDI environment of an enterprise.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates an example of a virtual desktop infrastructure (VDI)environment, in accordance with various embodiments;

FIG. 2 provides a more detailed example of virtual desktop environmentfor a particular client device and a particular VM according to variousembodiments;

FIG. 3 illustrates an example of a system for managing virtual desktopimages, in accordance with various embodiments;

FIG. 4 illustrates an example of a process for applying an update to avirtual machine hosting a virtual desktop, in accordance with variousembodiments;

FIG. 5 illustrates an example of a process for reading content from astub file, in accordance with various embodiments;

FIG. 6 illustrates an example of a process for writing content to a stubfile, in accordance with various embodiments;

FIG. 7 illustrates an example of a process for utilizing a branchreflector to update a virtual desktop, in accordance with variousembodiments;

FIG. 8 illustrates an example of a process for distributing the creationof stub files over time, by generating them on-demand, in accordancewith various embodiments;

FIG. 9 illustrates an example of some general components of a computingdevice, in accordance with various embodiments.

DETAILED DESCRIPTION

Systems and methods in accordance with various embodiments of thepresent disclosure overcome at least some of the above mentionedshortcomings and deficiencies by providing more efficient ways to managevirtual desktops in a virtualized desktop infrastructure (VDI)environment. In particular, embodiments described herein improve theefficiency of delivering updates, modifications and/or new softwareinstallations to virtual desktops that are executed on host servers in adata center.

As used herein, the terms “virtual desktop” and “desktop” refer to aninstance of an operating system or application that runs remotely withrespect to the user, e.g., on the host server system in a remotedatacenter. In a conventional VDI environment, each virtual desktopcorresponds to a virtual machine (VM) executed on a host server (i.e., ahost computing device). A host server may host any number of virtualmachines (e.g., tens, hundreds, etc.) and each virtual machine may beowned by an individual user. The virtual machine typically includes aguest operating system (e.g., Windows) capable of executing applicationsfor the user and the virtual machine is used to provide a virtualdesktop for the individual user. The user that owns the virtual desktopcan remotely log into their virtual desktop using a client device thatestablishes a network connection with the host server and remotelyexecute various applications on the virtual machine as if the desktopwas running on the user's local client device.

Since multiple virtual machines are typically hosted on a single hostserver, all of the virtual machines on that server share the physicalresources of that server, including but not limited to one or morecentral processing units (CPUs), random access memory (RAM), flashmemory, disk, network interface card (NIC) and the like. The host serveralso usually includes a hypervisor or other virtualization software thatmanages all of the virtual machines and their access to the physicalresources of the host server. When an IT department wishes to deploy anew application or distribute a software update to all users within anenterprise, the new application or update first needs to be transmittedto each user's virtual machine (i.e., all virtual desktops) and theneach virtual machine needs to perform the installation or update.Because many virtual machines (e.g., tens, hundreds, etc.) may besharing the resources of one host server, those resources can beoverwhelmed, thereby leading to poor end user experience if the userhappens to be using their virtual desktops during the update.

In various embodiments, the desktop image management system describedherein can improve the performance and efficiency of such distributionof new or updated applications, operating systems or other software. Thedesktop image management system is comprised of an agent and a centralserver. The image management agent can be downloaded and installed oneach virtual machine that executes the virtual desktop for an individualuser. Alternatively, to make the process of installing the agent easier,the agent can be distributed by adding the agent to a template of avirtual machine. In this case, the agent would be cloned upon each newVM creation. This makes the process of deploying the agent onto theendpoints easier since the agent does not need to be downloaded andinstalled on every virtual desktop. Once up and running on the VM, theagent is responsible for scanning the file system, registry and otherinformation of the virtual machine that comprise the desktop image ofthe user and for transmitting copies of all of this information to thecentral server. This initial transmission of the desktop imageinformation is referred to herein as “centralization”. In variousembodiments, to optimize the centralization process, the agent may onlytransmit those files and information (e.g., blocks) to the centralserver which are not already available on the central server. Thecentral image management server is responsible for storing desktopimages for each virtual machine in the enterprise. In addition, thecentral server provides a console that enables an IT administrator todistribute software updates to each agent that is installed on anendpoint virtual machine. In some embodiments, the software update to bedistributed to an individual virtual machine may comprise an applicationlayer. An application layer is composed of a set of files and registryentries which need to be properly merged on the endpoint virtual machinein order to install a new application (or updated version of theapplication) on that virtual machine.

To improve efficiency of distribution of the software updates, each hostserver utilizes a single instance store which will contain any update ornew application to be deployed on the virtual machines running on thathost server. When an IT administrator uses the console of the centralserver to distribute an update (e.g., new application) to all virtualmachines running on the host server, a single copy of all the filesnecessary for installing the new application are transmitted to the hostserver and stored in the single instance store. This eliminates the needto distribute the necessary files to each and every virtual machinerunning on that server individually. This reduces network traffic andstorage requirements of the host server.

Once the host server receives the request to update a file, the contentof the file is stored in the single instance store. Thereafter, allupdating of the file to all virtual machines can be performedinternally, on the host device, thereby reducing the overall networktraffic in the data center. In one embodiment, to perform the updateprocess, for each file in the single instance store, the virtual disklayer within the hypervisor on the host computing device creates acorresponding “stub” file on each virtual machine that is to be updated.As used herein, the term “stub file” refers to a file that is empty ofcontent. In other words, the host server does not actually copy thecontent of the file stored in the central instance store into each andevery VM but instead creates a stub file or dummy file on the disk ofeach virtual machine. Creating such stub files does not introduce a lotof input/output (I/O) operations on the server because the host serveris simply marking the metadata in the file system to indicate that thereis a file on the virtual machine but it does not write the actualcontent of that file to the virtual disk of the VM. After the stub filesare created, the stub files are marked to indicate that those filesactually do not have any content.

Subsequently, if the VM requests the content of the stub file, thehypervisor (i.e., virtual disk layer) of the host server will need todeliver the content on demand from the single instance store. When theagent on the VM completes the update operation, the files are stillempty of content. However, when the user tries to use the application,the guest operating system installed on the VM will try to access ablock of content of the stub file. The virtual disk layer will detectthis access request and quickly fetch the requested block from thesingle instance store. Because this block is stored in the memory orfast-tier storage (e.g., SSD) of the host server (i.e., the singleinstance store), the fetching does not require the copying of any blocksand thus the operation can be performed very fast. As such, there is noneed to actually copy the content of the file to the virtual machinedisk file of the VM that requested the operation.

The result of this process is that the layer update operation iscompleted quickly—as it doesn't require the layer's content to be copiedover and over again to each and every target VM (which would generate alot of I/O). Instead, the techniques described herein only need to copythe content of each file once to each host server (to build the singleinstance store on that server). The rest of the process only requirescreation of stub/empty files, which requires substantially less I/Oresources (reduces impact on I/O, CPU and network resources of theentire virtual desktop infrastructure). Furthermore, the single instancestore can be cached in more efficiently accessed memory, such as randomaccess memory (RAM) or flash memory, so that fetching the blocks fromthat store is a rapid process.

FIG. 1 illustrates an example of a virtual desktop infrastructure (VDI)environment, in accordance with various embodiments. VDI environmentincludes host servers (102-1, 102-2, 102-N) that are communicativelycoupled with a number of client devices (120-1, 120-2, 120-N) via anetwork 106. Network 106 may be a local area network (LAN), wide areanetwork (WAN) or other form of remote communication link between thehost servers (102-1, 102-2, 102-N) and client devices (120-1, 120-2,120-N). Network 106 may further include numerous other components, suchas one or more firewalls, connection brokers, management servers, etc.,which are not shown here so as to not obscure salient features of theVDI environment. Host servers (102-1, 102-2, 102-N) may physicallyreside in a data center 101 of the enterprise or in a data center of athird party service provider.

By way of illustration, host server 102-1 can interoperate with clientdevices (120-1, 120-2, 120-N) to provide virtual desktop services tousers of client devices (120-1, 120-2, 120-N). For example, host server102-1 can host, for each user, a desktop that is presented by a guestoperating system (such as one of the guest operating systems 105-1,105-2, 105-N) running on a virtual machine (such as one of the virtualmachines 110-1, 110-2, 110-N) on host server 102-1. As used herein, theterm “desktop” refers to a computing environment in which a user canlaunch, interact with, and manage the user's applications, settings, anddata. Each client device (120-1, 120-2, 120-N) can allow a user to viewon a desktop graphical user interface (GUI) (via a local display device)his/her desktop that is running remotely on host server 102-1, as wellas provide (via one or more local input devices) commands forcontrolling the desktop. In this manner, the users of client devices(e.g., 120-1, 120-2, 120-N) can interact with the desktops hosted onhost server 102-1 as if the desktops were executing locally on clientdevices (120-1, 120-2, 120-N).

In the embodiment of FIG. 1, host server 102-1 includes virtualizationsoftware 104 that supports the execution of one or more virtual machines(VMs) (e.g., 110-1, 110-2, 110-N). The virtualization software 104 maybe a hypervisor, a virtual machine manager (VMM) or other software thatallows multiple virtual machines to share the physical resources of theserver. In the illustrated embodiment, each virtual machine (e.g.,110-1, 110-2, 110-N) can execute a guest operating system (GOS) (e.g.,105-1, 105-2, 105-N) that hosts a desktop for a single user at a time.For example, if five users connect to host server 102-1 for the purposeof initiating remote desktop sessions, the host server 102-1 can launchfive VMs, each hosting one desktop for each one of the five users. Thistype of remote desktop architecture where user desktops are hostedwithin separate, server-side virtual machines is referred to as virtualdesktop infrastructure, or “VDI.” Each client device (e.g., 120-1,120-2, 120-N) can execute a remote desktop client application (e.g.,122-1, 122-2, 122-N). The interaction between the virtual desktop andthe client device can be facilitated by the remote desktop clientapplication (e.g., 122-1, 122-2, 122-N) running in the OS (e.g., 121-1,121-2, 121-N) on the client device (e.g., 120-1, 120-2, 120-N) whichcommunicates with a server-side remote desktop agent (e.g., 103-1,103-2, 103-N) that is running on the guest OS inside the virtual machine(e.g., 110-1, 110-2, 110-N). In particular, the interaction can beperformed by the remote desktop agent transmitting visual displayinformation (e.g., framebuffer information) to the remote desktop clientand the remote desktop client in turn transmitting user input events(e.g., keyboard, mouse events) to the remote desktop agent.

It should be noted that the particular VDI deployment illustrated inFIG. 1 is shown purely for purposes of illustration and is not intendedto be in any way inclusive or limiting to the embodiments that aredescribed herein. For example, a typical enterprise VDI deployment wouldinclude many more host servers which may be distributed over many datacenters, which include many other types of devices, such as switches,power supplies, cooling systems and other environmental controls, andthe like, which are not illustrated herein. Similarly, a single hostserver would typically host many more virtual machines than what isshown in this illustration. It will be apparent to one of ordinary skillin the art that the example shown in FIG. 1, as well as all otherfigures in this disclosure have been simplified for ease ofunderstanding and are not intended to be exhaustive or limiting to thescope of the invention.

FIG. 2 provides a more detailed example of virtual desktop environmentfor a particular client device 104 and a particular VM 110 according tovarious embodiments. As previously described and illustrated in thisfigure, client device 104 includes a remote desktop client application204 and VM 110 includes a corresponding remote desktop server-side agentapplication 208. Remote desktop client application 204 and remotedesktop agent application 208 can communicate via a remoting protocol214 to enable the remote virtual desktop features described above withreference to FIG. 1.

Remote desktop agent application 208 can capture images of a desktop 206running within VM 110 and send, via remoting protocol 214, the desktopimages to remote desktop client application 204. For example, using VNCprotocol, the desktop image information contained in the framebuffer onthe server system 102 can be encoded and transmitted to the remotedesktop client application 204 on the client device 104. The framebufferis a portion of memory containing the information used to display thepixels on the display screen. Remote desktop client application 204 canprocess the received desktop images (e.g., the encoded framebuffer) toupdate a part of the desktop GUI that is presenting a local view 210 ofdesktop 206 on client device 104. The desktop GUI is displayed on one ormore display devices 202 (only one shown). Therefore, the desktop GUIpresents a local view 210 of desktop 206 to a user of client device 104on display device 202.

Remote desktop client application 204 can receive user inputs directedto desktop 206 and forward the user inputs, via the remoting protocol214, to remote desktop agent application 208. The user inputs can bereceived on the desktop GUI that is presenting local view 210. As thevisual state of desktop 206 changes (either in response to the userinputs or due to activity initiated by applications/processes running ondesktop 206), remote desktop agent application 208 can update thedesktop images that are sent to remote desktop client application 204(e.g., by transmitting updated framebuffer information) to reflect thosechanges in real-time or dynamically by updating local view 210 ondisplay device 202, e.g., immediately upon the changes being generatedat desktop 206.

FIG. 3 illustrates an example of a system for managing virtual desktopimages, in accordance with various embodiments. In various embodiments,the system for managing the virtual desktop images can be comprised of acentral desktop image management server 304 and a desktop managementagent 309 that is installed on each virtual machine running a virtualdesktop. When the agent 309 is first executed on the virtual machine(e.g., 312-1), the agent 309 performs an initial centralization processby scanning the contents of the local file system in the virtual machine312-1 and uploading any missing files (i.e., files which are not alreadyavailable on the central server) to the central server. Once thecentralization process is complete, the central server 304 contains afull image of the user's desktop, including the operating system,applications and user data 308. As such, the agent 309 is responsiblefor scanning/uploading the desktop image to the central server 304 andfor merging any updates/layers with the content on the virtual machine.The central server 304 is responsible for storing the images of allendpoints (i.e., virtual machines) and for providing an administratorwith a console to perform various operations (e.g., updates, newsoftware deployments, etc.) on the client. The central server 304 storesall the desktop images in a single instance store in an efficientmanner, without duplication of the same files or blocks. This helpsoptimize the storage space and network communications.

Once the initial centralization process is complete, the agent 309 iscapable of performing various fixes, updates and new softwareinstallations on the virtual machine 312-1. For example, the ITadministrator can use a console on the central server 304 to apply a newbase layer or an application layer to the desktop image that the userhas on their virtual machine 312-1. As used herein, the term “layer” isa set of files, registry entries and other databases (e.g.,Windows-specific databases, etc.) that are necessary to be merged ontothe virtual machine in order to apply a change to the virtual machine. Abase layer contains all of the files, registry entries and databasesrequired to run an operating system with a set of predefinedapplications, drivers and virtual devices on the virtual machine. Anapplication layer, on the other hand, contains all of the files,registry entries and databases required to merge a new application (oran updated version of an existing application) on the virtual machine.The application layer may also include drivers and virtual devices.

When an administrator decides to apply a change to a target virtualmachine using the console of the central server 304, the administratorcan first create an application layer or a base layer (or select anexisting layer). The administrator can then instruct the central server304 to send the base or application layer to a virtual machine. Thecentral server 304 has a full listing of the files on each target VM(i.e., the desktop image of that VM which it obtained from the agent)and the central server 304 also has a full listing of the files in theapplication layer. The server 304 also has the registry (e.g., Windowsregistry) of the target VM and the registry of the application layer.Based on the differences, the central server 304 determines which filesare missing on the target VM and these files need to be downloaded fromthe server 304 in order to apply the layer. The downloading of the filescan be performed by the agent running on the target VM or by an agentrunning on a different VM, as described later in this document. Thedelivery of the files can be performed in an optimized manner such thatthe agent 309 does not need to download those files which already existlocally on the target VM 312-1. Instead, the agent 309 determines whichfile blocks are needed on the target VM 312-1, downloads thoseparticular blocks from the server 304 and stores the blocks into a sidefolder (i.e., staging area 307). Once the agent 309 has all thenecessary files and registry entries of the app layer, the agent 309 isresponsible for performing an offline merge of the content of the targetvirtual machine 312-1 with the content of the application layer (or baselayer), as described in further detail below. In some embodiments, theend user may be required to restart the operating system on the virtualmachine when the merge is completed.

When a base layer or application layer is applied to a set of VMs (e.g.,VMs 312-1, 312-2, 312-N) on a host server 301, the central server firstsends all the files and content of the layer to a single instance store(SIS) 305 residing in that host server 301. Each host server includesexactly one single instance store 305 and this single instance store 305keeps a single copy of each unique file that will be utilized by thelayers being applied to the virtual machines running on the host server301. In alternative embodiments, rather than storing a single copy ofeach unique file, the single instance store may store each unique blockof the files.

In some embodiments, the downloading and storing the files in the singleinstance store is performed by an agent running on the target virtualmachine that is to be updated. In other embodiments, an agent on one ofthe other virtual machines (312-1, 312-2, 312-N) can be nominated a“branch reflector” for all virtual machines on the entire host server301 based on virtual infrastructure information. This designated branchreflector will be responsible for creating the local single instancestore 305 by downloading the relevant layers from the central server 304on behalf of other VMs that are residing on the same physical hostserver. The selection of which agent on which VM is designated to be thebranch reflector can also be overridden by the administrator or madeotherwise configurable.

When the agent 309 in the target VM 312-1 (or in an agent on a differentVM that was nominated to be the branch reflector) detects that a base orapplication layer needs to be downloaded to the target VM 312-1, theagent 309, downloads from the central server 304 a set of files that aremissing in the virtual machine 312-1 (and are not available in thesingle instance store) and are part of the new base layer or applicationlayer which is being delivered. For example, the agent may download afile “c:\windows\system32\app.dll” that is 3 megabytes (MB) in size. Inthe embodiments where the downloading is performed by the agentnominated as branch reflector, the branch reflector can provideadditional information for each file, such as the list of its blocks andtheir real (physical) location on the disk (e.g., virtual machine disk(VMDK)).

For each such downloaded file, the agent 309 on the target VM creates astub file of the same size (e.g., 3 MB). As previously mentioned, thestub file is empty of actual content and only the metadata is marked toindicate that such a file exists. In various embodiments, the stubfile(s) can be created in a number of different ways, each of which willbe described below.

In one embodiment, the stub file is created in a separate staging area307. The staging area 307 can be a dedicated, protected file-systemfolder in the target virtual machine. Following the example above, theagent 309 may create an empty stub file of size 3 MB in the staging area“c:\StagingArea\windows\system32\app.dll” on the virtual machine. Nocontent is written to the stub file, so that the operation of creatingthe stub file only changes information in the master file table of thefile-system. This is a relatively quick operation with little I/Oimpact. The file's meta-information (e.g. attributes, timestamps,security information, etc.) is set correctly on the file. This shouldalso be a quick operation requiring little I/O resources. The agent 309also collects the offsets of disk blocks which were allocated for thisfile on the underlying physical disk (i.e., in the single instance store305).

Additionally, the agent 309 downloads the registry hives of the base orapplication layer and creates a merged copy of the corresponding localregistry hive of the virtual machine 312-1 with the base or applicationlayer registry hive. This copy is placed in the staging area 307 aswell. All of the downloading of necessary files and registry hives canbe performed in the background, while the user is using their virtualdesktop running on the virtual machine.

Once the downloading is complete, the agent asks the user to restart hismachine. When the operating system completes its shut down sequence,instead of restarting the virtual machine, the agent 309 shuts down themachine. The VM is stopped. The agent 309 then informs the host server301 of the list of empty files and their corresponding block offsets onthe disk. The host server 301 keeps a mapping of these virtual diskblocks to the corresponding logical offsets of files or blocks in thehost's single instance store 305. The agent 309 then boots the VM andduring early boot time, a boot-time agent moves the stub files from thestaging area 307 into their designated locations. Following the exampleabove, the agent would move the file“c:\StagingArea\windows\system32\app.dll” into location“c:\windows\system32\app.dll”. It should be noted that this operationdoes not change the allocated blocks for this file on the physical disk,only changes the master file table of the file-system.

In an alternative embodiment, rather than creating the stub file in aseparate staging area 307, the stub file can be created directlyin-place (i.e., in the appropriate location for the application to run)upon the next boot of the virtual machine. Since the stub files areempty of content, creating all of the necessary stub files wouldnormally not impact the boot time very significantly and this operationcan be tolerable to the end user experience.

While as mentioned above, the creation of these stub files is ordinarilynot very expensive in terms of I/O, in some cases, the process maynonetheless create a short I/O burst if all of the needed stub files arecreated at once. In order to prevent or reduce this initial I/O burst,in some embodiments, the I/O incurred in creating the stub files can bedistributed over time. Thus, in these embodiments, instead of creatingthe stub files upfront (either in the staging area or in-place), thestub files can instead be created on-demand, when the directorycontaining them is first accessed by an application (i.e., by theoperating system). By way of example, an application “App” may contain aset of files in a directory, as shown in the Table below:

C:\App C:\App\f1.txt C:\App\f2.tx ... C:\App\fn.txt C:\App\SubdirC:\App\Subdir\g1.txt

In this example, to distribute the initial I/O burst over a longerperiod of time, the agent will only create the directory “C:\App” andmark it in a special manner to indicate that this directory is empty ofcontent. Thereafter, once an application tries to open the directory“C:\App”, the agent can intercept this directory open request andimmediately create the empty stub files (e.g., “f1.txt”, “f2.txt” . . .“fn.txt”, etc.) before the directory open request is completed. Notethat in addition to all of the stub files, the subdirectories of thedirectory (e.g., “C:\App\Subdir”) are created as well, but not any ofits children directories (these children would only be created if“C:\App\Subdir” is explicitly accessed subsequently by the application).In this manner, the I/O of creating the stub files is distributed overtime and only for directories which are actually accessed—stub files indirectories which are never accessed would never be created.

After the stub files (and/or directories) have been created, theboot-time agent may perform another restart of the OS. In alternativeembodiments (e.g., embodiments where the stub files are createdon-demand), no restart may be necessary. When any process/thread runningin the guest OS tries to read a block which was part of any of the emptystub files which were previously created, the host server 301 willtransparently provide the block from the single instance store 305. Thishooking can be performed at the virtual disk layer 313 of the hostserver 301. The hooking of these operations is transparent to the OS, asit happens at the disk block level. For example, when the file systemdriver 306 of the guest operating system installed on the virtualmachine 312-1 receives the read operation, it forwards the readoperation to the disk driver 311, which is then handled by the virtualdisk layer 314. Because the block was previously marked to indicate thatthe block resides in the single instance store 305, the virtual disklayer 313 transparently provides the requested block from the singleinstance store 305.

When any process/thread running in the guest OS tries to write a blockwhich was part of any of the empty stub files which were previouslycreated, the host server 301 will write the desired block down to thevirtual disk 314 (e.g. VMDK) and remove this block from the mappingwhich was previously created. Subsequently, any read operations on thatblock will return data from the newly written block directly, ratherthan fetching it from the single instance store.

In some embodiments, as an alternative to implementing the file mappingapproach described above, an agent designated as the branch reflectorcan be used to stream the files on-demand to the requesting applicationrunning on a different VM on the same host. In these embodiments, thestub files can still be created as offline files in a staging area (orin-place), as previously described. Thereafter, when an applicationaccesses a file, the file access can be intercepted on higher levelguest operating system component, such as by a file system mini filterdriver or NTFS driver, and the entire file can be streamed on-demandfrom dedicated branch reflector. Since the branch reflector is local(i.e., resides on the same physical host server as the VM running theapplication), the streaming will be a memory-only transfer with highspeed performance. Furthermore, if the single instance store ismaintained in high performance memory (e.g., SSD or RAM), the process oflaunching the application will be even further improved since theapplication files are loaded with less latency than conventionallyloading the files from disk.

FIG. 4 illustrates an example of a process for applying an update to avirtual machine hosting a virtual desktop, in accordance with variousembodiments. As illustrated in operation 401, the administrator createsan application layer or a base layer to be distributed to a set ofvirtual machines. The application layer or base layer includes allfiles, registry entries and databases required to apply a change to theuser's desktop. Once the administrator has created the application layeror base layer, the administrator may use the console of the centralserver to apply the application layer or base layer to a set of targetvirtual machines.

In operation 402, the application layer is distributed from the centralserver to the host server hosting the target VM. In various embodiments,the host server may also be hosting multiple other virtual machines,which correspond to different users. In operation 403, the host serverstores the files of the application layer in a single instance store onthe host server. In various embodiments, the single instance storestores each unique copy of the files of the application layer so thatthe files need not be replicated across all VMs running on the hostserver.

Once the files have been downloaded from the central server and storedin the single instance store, the agent running on each VM can apply theapplication layer to the corresponding VM. In operation 404, the agentrunning on the VM creates a set of stub files (files empty of content)corresponding to the files of the application layer whose content isphysically stored in the single instance store. Creating a stub file canbe performed by marking the appropriate metadata in the file system toindicate that the file exists there but without copying the actualcontent of that file to the location. This can save a significant amountof I/O operations because writing the content is typically the majortime cost of the overall process. The stub files are created in aseparate staging area while the user can continue using their desktop inthe virtual machine.

In operation 405, the stub files are marked to indicate that they aremapped to the single instance store. It should be noted that inalternative embodiments, the single instance store can store content onthe block level (i.e. store each unique block of content) and in thoseembodiments, the block would be marked to indicate that it is mapped tothe single instance store. In operation 406, the virtual machine isrebooted. Upon rebooting the virtual machine, the agent switches thestaging area to the live system folder. At this point, the virtualmachine is up and running with the application layer (or base layer)having been applied to the virtual machine.

FIG. 5 illustrates an example of a process for reading content from astub file, in accordance with various embodiments. As illustrated inoperation 501, once the agent has completed the merge process, a usermay utilize the virtual desktop with the change having been applied. Forexample, as shown in operation 501, the user may execute a newapplication that has been installed as part of applying the applicationlayer. When the user tries to use the application, the guest operatingsystem installed on the virtual machine may request to read a block ofcontent from the stub file, as shown in operation 502. When the block isrequested, the virtual disk layer (e.g., hypervisor) detects the requestand determines that the requested block has been marked as being mappedto the single instance store (operation 503). The virtual disk layerthen fetches the request from the single instance store and provides theblock to the guest operating system, as shown in operation 504. Becausethe process shown in FIG. 5 is merely mapping blocks in memory withoutmaking any network communications, the process can be performed veryefficiently, without impacting the experience of the end user.

Furthermore, in some embodiments, the contents of the single instancestore can be placed in RAM, flash (SSD) or other efficiently accessiblememory, thereby improving performance further. In these embodiments, theperformance of launching applications and the operating system in theguest VMs is actually improved because the application files reside infast memory (e.g., RAM or SSD) and therefore these files will be fetchedquicker than conventionally stored application files on disk.Furthermore, in some embodiments where a branch reflector is used topopulate the layer data in the single instance store, the branchreflector can also interact with the in-memory cache module in order toindex the downloaded data immediately. In some embodiments, thein-memory cache can be enhanced to pin the layer content within thecache to avoid unnecessary eviction (since the application files arelikely to be accessed multiple times by multiple virtual machines).

FIG. 6 illustrates an example of a process for writing content to a stubfile, in accordance with various embodiments. In some embodiments, whenthe user is using the application (operation 601), the application mayattempt to write data to the stub file. When the guest OS receives awrite I/O request from the application, it will attempt to write theblock to the stub file on the VM, as shown in operation 602. In thiscase, the virtual disk layer will perform the write directly onto theblock in the virtual disk file (e.g., VMDK) of the VM, as shown inoperation 603. Additionally, the virtual disk layer will remove themarking of the block to indicate that this particular block is no longermapped to the single instance store, as shown in operation 604.Thereafter, any read operations that request to read the block, willreturn the contents of the block in the virtual disk of the VM, ratherthan the single instance store.

In some embodiments, the updating of the VMs on a host server can beimproved using linked clone VMs. A linked clone is a copy of a virtualmachine that shares virtual disks with the parent virtual machine (i.e.,the VM from which it was copied) in an ongoing manner That is, certainvirtual pages of both the parent and the linked clone are mapped to thesame physical memory pages. This is sometimes done to conserve diskspace and also allows multiple virtual machines to use the same softwareinstallation. In the context of updating the virtual desktops of users,the linked clone feature can improve the speed of updating certain VMson the physical server. For example, this approach can be useful fordeployments with homogenous virtual desktops and a relatively smallamount of user data. In those cases, a layer update can be done by firstupdating the parent VM which has multiple clones. The updating of theparent VM simultaneously updates all of the linked clone desktop VMsthat are anchored to the parent virtual machine except for updating theuser data, which can then be streamed on-demand from the central server.This particular approach assumes that amount of data is relatively smallso that network and back-end storage are not a bottleneck.

FIG. 7 illustrates an example of a process for utilizing a branchreflector to update a virtual desktop, in accordance with variousembodiments. In operation 701, an agent on one of the virtual machineson the host server is designated to be the branch reflector for allother virtual machines executing on that host. In operation 702, theagent designated to be the branch reflector determines that an updateshould be applied to one or more of the other virtual machines on thehost server. For example, the branch reflector may determine that anapplication layer should be applied to all of the virtual machines(i.e., virtual desktops) running on the host. In operation 703, thebranch reflector downloads the necessary files, registry entries,drivers and other data from the central server. The downloading of thesefiles can be performed over a network connection (e.g., LAN, WAN, etc.).In operation 704, the branch reflector stores the downloaded files in asingle instance store. In various embodiments, the single instance storestores each unique version of the files (or blocks) across all of thevirtual machines on the host server device. Once the files have beendownloaded and stored in the single instance store, the branch reflectorcan instruct the other agents running on other virtual machines to applythe updates to their respective target VMs. Thereafter, an agent runningon the target VM can create the stub files on the target VM, whichcorrespond to the actual files stored in the single instance store.These stub files can be mapped to the files in the single instancestore, such that any read request on those stub files will cause thevirtual disk layer to return the data from the file in the singleinstance store. In some alternative embodiments, the files can bestreamed on-demand by the branch reflector in response to such requeststo read the file, as previously described.

FIG. 8 illustrates an example of a process for distributing the creationof stub files over time, by generating them on-demand, in accordancewith various embodiments. In operation 801, an update is received by anagent on the target VM (or by the branch reflector agent). For example,the update may be a new application layer that is to be installed on thevirtual desktop. In operation 802, the agent downloads the files andstores the files in the single instance store, as previously described.In operation 803, the agent creates a directory corresponding to theapplication that is to be installed. In one embodiment, the directory isempty of content and does not contain any stub files. Thereafter, theoperating system can intercept a request to open the directory, as shownin operation 804. For example, the request may be intercepted by a filesystem mini filter driver or other component of the guest operatingsystem at the time when an application requests to open the directory.In response to intercepting the request, the agent creates stub filesfor each file that should be included in the directory, as shown inoperation 805. Additionally, in operation 806, the agent can map thestub files to the actual files stored in the single instance store.Subsequently all read requests will return the data from the singleinstance store, as previously described.

FIG. 9 illustrates an example of some general components of a computingdevice, in accordance with various embodiments. In this particularexample, the device includes one or more processors (e.g., centralprocessing units (CPUs) 902 for executing instructions that can bestored in physical memory component 904. The memory component 904 caninclude many types of memory, data storage, or non-transitorycomputer-readable storage media, such as random access memory (RAM)storing program instructions for execution by the processor 902, aseparate form of storage for images or data, a removable memory forsharing information with other devices and the like. The memorycomponent 904 typically can further comprise a display component 906,such as a monitor, a touch screen, liquid crystal display (LCD), or thelike. In various embodiments, the computing device will include at leastone input device 908 able to receive conventional input from a user.This conventional input can include, for example, a push button, touchpad, touch screen, wheel, joystick, keyboard, mouse, keypad, or anyother such device or element whereby a user can input a command to thedevice. In some embodiments, the computing device can include a networkinterface component (NIC) 908 for communicating over various networks,such as a Wi-Fi, Bluetooth, RF, wired, or wireless communicationsystems. The device in many embodiments can communicate over a network,such as the Internet, and may be able to communicate with other devicesconnected to the same or other network.

Various embodiments described herein can be implemented in a widevariety of environments, which in some cases can include one or moreuser computers, computing devices, or processing devices which can beused to operate any of a number of applications. User or client devicescan include any of a number of general purpose personal computers, suchas desktop or laptop computers running a standard operating system, aswell as cellular, wireless, and handheld devices running mobile softwareand capable of supporting a number of networking and messagingprotocols. Such a system also can include a number of workstationsrunning any of a variety of commercially-available operating systems andother known applications for purposes such as development and databasemanagement. These devices also can include other electronic devices,such as dummy terminals, thin-clients, gaming systems, and other devicescapable of communicating via a network.

Many embodiments utilize at least one network that would be familiar tothose skilled in the art for supporting communications using any of avariety of commercially-available protocols, such as TCP/IP, FTP, UDP orthe like. The network can be, for example, a local area network, awide-area network, a virtual private network, the Internet, an intranet,an extranet, a public switched telephone network, an infrared network, awireless network, and any combination thereof.

The various environments in which the embodiments can be implemented mayinclude a variety of data stores and other memory and storage media, asdiscussed above. These can reside in a variety of locations, such as ona storage medium local to one or more of the computers or remote fromany or all of the computers across the network. In some embodiments, theinformation, such as raw data or corresponding virtual machine disk(VMDK) container may reside in a storage-area network (“SAN”).Similarly, any necessary files for performing the functions attributedto the computers, servers, or other network devices may be storedlocally and/or remotely, as appropriate. Where a system includescomputerized devices, each such device can include hardware elementsthat may be electrically coupled via a bus, the elements including, forexample, at least one central processing unit (CPU), at least one inputdevice (e.g., a mouse, keyboard, controller, touch screen, or keypad),and at least one output device (e.g., a display device, printer, orspeaker). Such a system may also include one or more storage devices,such as disk drives, optical storage devices, and solid-state storagedevices such as random access memory (“RAM”) or read-only memory(“ROM”), as well as removable media devices, memory cards, flash cards,etc.

Such devices also can include a computer-readable storage media reader,a communications device (e.g., a modem, a network card (wireless orwired), an infrared communication device, etc.), and working memory asdescribed above. The computer-readable storage media reader can beconnected with, or configured to receive, a computer-readable storagemedium, representing remote, local, fixed, and/or removable storagedevices as well as storage media for temporarily and/or more permanentlycontaining, storing, transmitting, and retrieving computer-readableinformation. The system and various devices also typically will includea number of software applications, modules, services, or other elementslocated within at least one working memory device, including anoperating system and application programs, such as a client applicationor Web browser. It should be appreciated that alternate embodiments mayhave numerous variations from that described above. For example,customized hardware might also be used and/or particular elements mightbe implemented in hardware, software (including portable software, suchas applets), or both. Further, connection to other computing devicessuch as network input/output devices may be employed.

Storage media and computer readable media for containing code, orportions of code, can include any appropriate media known or used in theart, including storage media and communication media, such as but notlimited to volatile and non-volatile, removable and non-removable mediaimplemented in any method or technology for storage and/or transmissionof information such as computer readable instructions, data structures,program modules, or other data, including RAM, ROM, EEPROM, flash memoryor other memory technology, CD-ROM, digital versatile disk (DVD) orother optical storage, magnetic cassettes, magnetic tape, magnetic diskstorage or other magnetic storage devices, or any other medium which canbe used to store the desired information and which can be accessed by asystem device. Based on the disclosure and teachings provided herein, aperson of ordinary skill in the art will appreciate other ways and/ormethods to implement the various embodiments.

The specification and drawings are, accordingly, to be regarded in anillustrative rather than a restrictive sense. It will, however, beevident that various modifications and changes may be made thereuntowithout departing from the broader spirit and scope of the invention asset forth in the claims.

What is claimed is:
 1. A system for virtual desktop image management,the system comprising: a central server storing a set of updates to beapplied to a plurality of virtual machines, each of the set of updatesincluding one or more of: files, registry entries, or drivers; a hostserver device hosting the plurality of virtual machines, the host serverdevice connected to the central server via a communication connection,the host server device further including: a first virtual machineincluding a first agent nominated to be a branch reflector for all ofthe plurality of virtual machines hosted on the host server device; asecond virtual machine that is to be updated with at least one of theset of updates from the central server, the second virtual machineincluding a second agent; wherein the first agent on the first virtualmachine is configured to (a) determine that an update is to be appliedto the second virtual machine, (b) download the files, registry entriesand drivers from the central server on behalf of the second virtualmachine (c) store the files, registry entries and drivers in a singleinstance store on physical storage associated with the host server, and(d) provide an instruction to the second agent to apply the update tothe second virtual machine by creating one or more stub files; andwherein the one or more stub files are created on the second virtualmachine corresponding to at least some of the files, registry entries inthe single instance store, such that a request to read the one or morestub files returns content from the single instance store.
 2. The systemof claim 1, wherein the update is configured to install an applicationon the second virtual machine.
 3. The system of claim 2, wherein theapplication issues the request to read the one or more stub files, saidrequest intercepted by a filter driver on a guest operating system onthe second virtual machine.
 4. The system of claim 3, wherein inresponse to the intercepted request to read the one or more stub fileson the second virtual machine, the first agent nominated to be thebranch reflector on the first virtual machine is configured to streamthe content from the single instance store to the second virtualmachine.
 5. The system of claim 1, wherein the single instance store isin a content-based read cache residing in at least one of: random accessmemory (RAM) or a solid state drive (SSD) on the host computing device.6. The system of claim 5, wherein the first agent nominated to be thebranch reflector on the first virtual machine is configured to interactwith the content-based read cache in order to index the data of theupdate immediately after downloading the update from the central server.7. The system of claim 5, wherein content of the update is pinned withinthe content-based read cache.
 8. A method for desktop image management,said method comprising: nominating a first agent on a first virtualmachine hosted on a host server device to be a branch reflector for aplurality of virtual machines hosted on the host server device, the hostserver device connected to a central server that stores a set of updatesto be applied to a plurality of virtual machines, each of the set ofupdates including one or more of: files, registry entries, or drivers;determining, by the first agent on the first virtual machine, that atleast one of the set of updates should be applied to a second virtualmachine hosted on the host server device, the second virtual machineincluding a second agent; downloading an update including the filesregistry entries and drivers from the central server by the first agenton the first virtual machine; storing the update in a single instancestore on the host server device by the first agent on the first virtualmachine; providing an instruction from the first agent to the secondagent to apply the update to the second virtual machine by creating oneor more stub files; and creating the one or more stub files by thesecond agent on the second virtual machine corresponding to at leastsome of the files, registry entries and drivers in the single instancestore, wherein a request to read the one or more stub files on thesecond virtual machine returns content from the single instance store.9. The method of claim 8, wherein the update is configured to install anapplication on the second virtual machine.
 10. The method of claim 9,wherein the application issues the request to read the one or more stubfiles, said request intercepted by a filter driver on a guest operatingsystem on the second virtual machine.
 11. The method of claim 10,wherein in response to the intercepted request to read the one or morestub files on the second virtual machine, the first agent nominated tobe the branch reflector on the first virtual machine is configured tostream the content from the single instance store to the second virtualmachine.
 12. The method of claim 8, wherein the single instance store isin a content-based read cache residing in at least one of: random accessmemory (RAM) or a solid state drive (SSD) on the host computing device.13. The method of claim 12, wherein the first agent nominated to be thebranch reflector on the first virtual machine is configured to interactwith the content-based read cache in order to index the data of theupdate immediately after downloading the update from the central server.14. The method of claim 12, wherein content of the update is pinnedwithin the content-based read cache.
 15. A non-transitory computerreadable storage medium comprising one or more sequences ofinstructions, the instructions when executed by one or more processorscausing the one or more processors to execute the operations of:nominating a first agent on a first virtual machine hosted on a hostserver device to be a branch reflector for a plurality of virtualmachines hosted on the host server device, the host server deviceconnected to a central server that stores a set of updates to be appliedto a plurality of virtual machines, each of the set of updates includingone or more of: files, registry entries, or drivers; determining, by thefirst agent on the first virtual machine, that at least one of the setof updates should be applied to a second virtual machine hosted on thehost server device, the second virtual machine including a second agent;downloading an update including the files registry entries and driversfrom the central server by the first agent on the first virtual machine;storing the update in a single instance store on the host server deviceby the agent on the first virtual machine; providing an instruction fromthe first agent to the second agent to apply the update to the secondvirtual machine by creating one or more stub files; and creating the oneor more stub files by the second agent on the second virtual machinecorresponding to at least some of the files, registry entries anddrivers in the single instance store, wherein a request to read the oneor more stub files on the second virtual machine returns content fromthe single instance store.
 16. The non-transitory computer readablestorage medium of claim 15, wherein the update is configured to installan application on the second virtual machine.
 17. The non-transitorycomputer readable storage medium of claim 16, wherein the applicationissues the request to read the one or more stub files, said requestintercepted by a filter driver on a guest operating system on the secondvirtual machine.
 18. The non-transitory computer readable storage mediumof claim 17, wherein in response to the intercepted request to read theone or more stub files on the second virtual machine, the first agentnominated to be the branch reflector on the first virtual machine isconfigured to stream the content from the single instance store to thesecond virtual machine.
 19. The non-transitory computer readable storagemedium of claim 15, wherein the single instance store is in acontent-based read cache residing in at least one of: random accessmemory (RAM) or a solid state drive (SSD) on the host computing device.20. The non-transitory computer readable storage medium of claim 19,wherein the first agent nominated to be the branch reflector on thefirst virtual machine is configured to interact with the content-basedread cache in order to index the data of the update immediately afterdownloading the update from the central server.